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Abstract 

This  research  extends  our  earlier  work  to  improve  the  security  of  electric 
power  grids  subject  to  disruptions  caused  by  terrorist  attacks.  To  identify  critical 
system  components  (e.g.,  transmission  lines,  generators,  transformers),  we  devise 
bilevel  optimization  models  that  identify  maximally  disruptive  attack  plans  for 
terrorists,  who  are  assumed  to  have  limited  offensive  resources.  A  new  model 
captures  the  dynamics  of  system  operation  as  a  network  is  repaired  after  an 
attack,  and  we  adapt  an  earlier  heuristic  for  that  model’s  solution.  We  also 
develop  a  new,  mixed-integer  programming  model  (MIP)  for  the  problem;  a 
model  that  can  be  solved  exactly  using  standard  optimization  software,  at  least  in 
theory.  Preliminary  testing  shows  that  optimal  solutions  are  readily  achieved  for 
certain  standard  test  problems,  although  not  for  the  largest  ones,  which  the 
heuristic  seems  to  handle  well.  However,  optimal  solutions  do  provide  a 
benchmark  to  measure  the  accuracy  of  the  heuristic:  The  heuristic  typically 
achieves  optimality  gaps  of  less  than  10%,  but  occasionally  the  gap  reaches  25%. 
Research  will  continue  to  refine  the  heuristic  algorithm,  the  MIP  formulation, 
and  the  algorithms  to  solve  it.  We  also  demonstrate  progress  made  towards  a 
graphical  user  interface  that  allows  performing  our  interdiction  analysis  in  a 
friendly  environment. 
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1.  INTRODUCTION 


This  report  documents  the  continuing  research  project  entitled  “Homeland  Security  Research 
And  Technology  Proposal  (Optimizing  Electric  Grid  Design  Under  Asymmetric  Threat),”  which 
is  sponsored  by  the  U.S.  Department  of  Justice,  Office  of  Justice  Programs  and  Office  of 
Domestic  Preparedness. 

This  research  extends  our  previous  effort  aimed  at  developing  new  optimization  models  and 
methods  for  planning  expansion  and  enhancements  of  electric  power  grids  that  improve 
robustness  to  potential  disruptions  caused  by  natural  disasters,  sabotage  and,  especially,  terrorist 
attacks.  The  research  reported  here  shows  the  progress  made  in  different  areas  comprising 
modeling,  algorithms  and  their  implementation,  testing,  and  user  interfaces. 

The  document  is  organized  as  follows:  Section  2  presents  an  overview  of  project 
accomplishments  to  date.  Sections  3  through  7  describe  this  year’s  activities  in  detail.  In 
particular,  Section  3  describes  our  model  of  post-attack  system  restoration  over  time,  and  an 
associated  solution  procedure.  Section  4  focuses  on  a  new  model  representation  as  a  standard 
mixed-integer  program.  Computational  results  for  these  models  are  presented  in  Section  5, 
including  comparisons  with  earlier  results.  Section  6  presents  an  overview  of  our  new  “VEGA” 
decision-support  system,  which  includes  database  and  graphical  user-interface  tools,  along  with 
an  optimization  module.  Other  activities  are  summarized  in  Section  7.  Section  8  presents  an 
overview  of  the  work  intended  for  year  2004.  We  conclude  in  Section  9  with  the  list  of  criteria 
used  to  assess  the  value  of  our  project  to  Homeland  Security. 

2,  OBJECTIVE  AND  SUMMARY  OF  WORK  COMPLETED 

Our  project  develops  new  mathematical  models  and  optimization  methods  for  robust  planning 
of  electrical  power  grids,  focusing  on  security  and  reliability,  with  special  emphasis  on  potential 
disruptions  caused  by  terrorist  attacks.  We  refer  to  our  previous  proposal  [Salmeron  and  Wood, 
2002-1]  and  references  therein  for  detailed  background  on  the  problem  of  electric  power-grid 
vulnerability. 

A  statement  from  the  Committee  on  Science  and  Technology  for  Countering  Terrorism 
[2002]  succinctly  states  the  motivation  for  our  work:  “The  nation’s  electric  power  systems  must 
clearly  be  made  more  resilient  to  terrorist  attack.”  This  motivation  has  been  further  strengthened 
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by  the  blackout,  on  14  August  2003,  in  the  Northeast  U.S.  electric  power  grid  [U.S. -Canada 
Power  System  Outage  Task  Force,  2003].  Although  the  blackout  was  not  instigated  by  terrorists, 
its  cause  appears  to  have  been  multiple  failures  of  infrastructure  elements  in  the  transmission 
system,  and  our  current  research  addresses  precisely  such  situations. 

We  also  refer  to  our  previous  report  [Salmeron,  Wood,  and  Baldick,  2003-1],  where  we 
establish  the  mathematical  foundations  for  the  models  and  algorithms  that  we  have  enhanced  in 
the  research  reported  here. 

The  following  milestones  have  been  achieved  as  the  result  of  previous  and  current  research 
(see  proposals  by  Salmeron  and  Wood  [2002-1],  [2002-11]).  (Underlined  items  identify  the  most 
recent  contributions.) 

(1)  Formulation  of  mathematical  models  that  represent  the  problem  of  optimally  interdicting 
an  electrical  power  grid.  A  newer  formulation  includes  system  restoration  over  time. 

(2)  Development  of  heuristics  that  identify  highly  disruptive  attack  plans  to  a  specific  electric 
power  grid  given  limited  interdiction  resources.  Newer  heuristics  keep  pace  with  the 
developing  models  and  have  been  adapted  to  incorporate  system  restoration  over  time. 
This  algorithm  has  been  implemented  using  the  General  Algebraic  Modeling  Language 
software  [GAMS,  1996]. 

(3)  Incorporation  of  different  measures  of  effectiveness,  any  of  which  can  be  optimized: 

•  Short-term  power  disruption  (MW); 

•  Short-term  cost  ($/MW)  over  all  consumer  sectors; 

•  Long-term  energy  disruption  (MWh),  including  system  restoration  over  time;  and 

•  Long-term  cost  ($)  over  all  consumer  sectors,  including  system  restoration  over  time. 

(4)  Development  of  techniques  to  convert  models  in  (1)  into  standard  mixed-integer 
programs  that  can  be  solved  exactly.  This  means  that,  not  only  we  can  determine  “good” 
attack  plans,  as  our  heuristic  approach  (2)  does,  but  we  can  prove  that  these  plans  are 
optimal.  In  turn,  this  provides  us  with  a  precise  measure  of  vulnerability.  We  have 
implemented  and  solved  the  converted  models  using  GAMS  [1996], 
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(5)  Solution  to  cases  with  up  to  100  electrical  buses  (drawn  from  the  IEEE  Reliability  Test 
Data  [1999-1],  [1999-11]). 

(6)  Presentations  in  the  Homeland  Security  Leadership  Development  (HSLD)  seminars: 

•  “Electric  Power  Grids  Vulnerability,”  CS4920,  Naval  Postgraduate  School 
(3  December  2002). 

•  “Vulnerability  of  Electric  Power  Grids,”  CS3660,  Naval  Postgraduate  School 
(18  June  2003). 

(7)  Reports: 

•  First-year  report  [Salmeron,  Wood,  and  Baldick,  2003-1]. 

•  Research  Paper  [Salmeron,  Wood,  and  Baldick,  2003-11],  accepted  for  publication  in 
IEEE  Transactions  on  Power  Systems. 

(8)  Thesis  students  involvement: 

•  Major  Dimitrios  Stathakos,  Greek  Army.  “An  Enhanced  Graphical  User  Interface  for 
Analyzing  the  Vulnerability  of  Electrical  Power  Systems  to  Terrorist  Attacks,” 
[Stathakos,  2003],  graduated  in  December  2003. 

•  LCDR  Rogelio  Alvarez,  USN.  “Interdicting  Electrical  Power  Grids,”  graduation 
expected  in  March  2004. 

(9)  Graphical  User  Interface  (GUI)  Development:  We  realize  the  importance  of  enabling 
access  to  this  type  of  analysis  to  a  number  of  potential  users,  who  are  not  necessarily 
familiar  with  the  optimization  arena.  To  bridge  this  gap,  we  have  initiated  the  design  and 
implementation  of  the  “Vulnerability  of  Electrical  Power  Grids  Analyzer”  (VEGA) 
system.  VEGA  is  an  integrated  tool,  comprising  a  graphical  user  interface  (GUI),  a 
supporting  database  (DB)  and  the  aforementioned  optimization  tools.  A  preliminary  Web 
page  has  been  set  up  for  this  project  [VEGA,  2003].  VEGA  1.0  is  the  first  prototype  of 
this  system. 

We  next  describe  the  items  (l)-(9)  above  in  more  detail. 
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3.  MODELING  RESTORATION  AND  ALGORITHMIC  IMPLEMENTATION 

3.1  Previous  Interdiction  Model  without  Restoration 

The  mathematical  model  we  presented  in  our  previous  report  [Salmeron,  Wood,  and  Baldick, 
2003-1]  attempts  to  maximize  immediate  electric  power  shedding  by  (optimally)  selecting  a  set  of 
interdictions  given  limited  resources.  We  refer  to  that  report  for  a  full  description  of  its 
formulation,  which  can  be  shortly  stated  as  the  following  Max-min  (Mm)  problem: 

(Mm)  max  minc'p 

8eA  p 

s.t.  g(p,8)  <  b 

p  >  0 

Recall  that,  in  this  model,  an  interdiction  plan  is  represented  by  the  binary  vector  5 ,  whose 
k- th  entry  S.  is  1  if  component  k  of  the  system  is  attacked  and  is  0  otherwise.  For  a  given  plan, 

the  inner  problem  (called  DC-OPF)  is  an  optimal  power- flow  model  [Wood  and  Wollenberg, 
1996,  p.  514]  that  minimizes  generation  costs  plus  the  penalty  associated  with  unmet  demand, 
together  denoted  by  c '  p  .  Flere,  p  represents  power  flows,  generation  outputs,  phase  angles,  and 
“unmet  demand,”  i.e.,  the  amount  of  load  shed;  c  represents  linearized  generation  costs  and  the 
costs  of  unmet  demand.  The  outer  maximization  chooses  the  most  disruptive,  resource- 
constrained  interdiction  plan  5  e  A  ,  where  A  is  a  discrete  set  representing  attacks  that  a  terrorist 
group  might  be  able  to  carry  out.  In  this  model,  g  corresponds  to  a  set  of  functions  that  are 
nonlinear  in  (P  8) 

The  inner  problem  involves  a  simplified  optimal  power- flow  model,  with  constraint  functions 
g(p,8)  that  are,  however,  linear  in  p  for  a  fixed  5  =  8. 

3.2  Interdiction  Model  with  Restoration 

Overview 

Model  (Mm)  provides  only  a  rough  estimate  of  energy  shedding  and  thus  the  true  cost  to 
society  of  an  attack  on  a  power  grid.  This  is  because  (Mm)  is  based  on  the  system  capability  after 
the  initial  return  to  service  of  non-damaged  equipment  following  an  attack,  disregarding  medium- 
and  long-term  effects.  The  only  case  in  which  this  is  not  important  is  when  the  outage  duration  of 
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all  interdictable  components  in  the  system  is  the  same,  which  seems  unlikely  (e.g.,  interdicted 
substations  will,  in  general,  take  much  longer  to  repair  than  interdicted  lines). 

We  have  extended  model  (Mm)  to  handle  the  cost  and  timing  of  repairs,  which  allows  us  to 
obtain  interdiction  plans  seeking  to  maximize  total  cost  as  the  system  is  restored  over  time. 
Essentially,  this  model  measures  “total  weighted  energy,”  where  weights  represent  costs  of  lost 
energy  to  various  customer  sectors  and  possibly  other  factors. 

This  is  accomplished  by  using  interdiction  constructs  to  couple  instances  of  DC-OPF,  one  for 
each  system  state  that  represents  a  stage  or  “time  period”  of  system  repair.  In  outline,  the  model  is: 


(Mm') 


max  min  /  Ac’p 

8.A  p  ^ 

s.t.  g,(p,,5)<b  Vt&T 
p,  >  0  Vt  e  T. 


Model  (Mm)  extends  (Mm)  to  incorporate  the  hourly  cost  of  power  flow,  c’p  ,  in  each  time 
period  t,  multiplied  by  the  period’s  duration  in  hours  D  .  Figure  1  shows  the  difference  between 
potential  solutions  provided  by  (Mm)  and  (Mm'). 

The  model  could  be  further  extended  to  incorporate  “sub-time  periods”  through  load  duration 
curves,  but  we  have  not  yet  explored  this  possibility;  all  loads  are  held  constant  over  time. 

Following  the  notation  and  conventions  in  our  previous  report  (see  Appendix  A),  we  next 
describe  the  full  model  that  incorporates  system  restoration.  We  first  need  to  introduce  some 
additional  notation: 

T  =  set  of  periods,  for  t  sT 

£  =  L  uG’  u  B  u  S  ,  set  of  all  (directly)  interdictable  elements 
Dur(e )  =  Duration  (hours)  of  outage  for  element  e  e  g  ,  if  attacked 
Dt  =  Duration  (hours)  of  time  period  t,  for  i  el 
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1,  if  component  e  remains  unrepaired  in  time  period  t  after  being  attacked 
0,  if  component  e  is  repaired  before  time  period  t  after  being  attacked 
for  t  eT ,  e  e  ^  . 


Remark:  In  the  above  notation  ,  /?°us ,  /?,c“n  ,  and  /?,s“b  denote  /?,  e  when  e=l  is  a  line,  or 
e=i  is  a  bus,  or  e=g  is  a  generator,  or  e=s  is  a  substation,  respectively. 


Power  Shed  ▲ 
(MW) 

f" 

measure  of 
effectiveness 


- ► 

time  after 
the  attack 


Power  Shed  A 

(MW)  T 


measure  of 
effectiveness 


time  after 
the  attack 


► 


Figure  1.  The  model  without  restoration  provides  the  optimal  interdiction  plan  according  to 
instantaneous  power  shed,  after  initial  return  to  service  of  non-damaged  equipment  (left).  The  model 
with  restoration  over  time,  accounts  for  energy  disruption  (right). 


The  following  algorithm  constructs  the  set  of  time  periods,  T,  based  on  the  different  outage 
durations  for  all  interdictable  elements.  In  the  course  of  the  algorithm,  Dt  and  e  are  also 
constructed: 
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Algorithm  “Construct  Time  Periods”: 

Initialization:  S,  <—  T  <—  0,  t  <—  0,  m0  <—  0; 

While  <|^0: 
t  ^ —  t  + 1 

1,  if  e  e 
0,  otherwise 

mt  <—  min  |z)«r(e)  |e  e  <f  j 
^  <—  |e|e  e  a  Dur(e)  =  m,  | 

£>,  <-m,  -m,_j 

End  While 

Due  to  different  outage  duration  for  the  system  components,  we  need  to  establish  which 
components  might  be  out  of  service  during  each  time  period.  For  example,  if  a  line  /  can  be 
interdicted,  but  it  is  not  connected  to  an  interdictable  bus,  then  the  line  is  guaranteed  to  be  in 
service  after  Dur(J)  hours,  independent  of  whether  it  is  attacked  or  not.  At  this  point,  the 
following  definitions  are  needed: 

Set  of  lines  l  that  could  be  out  of  service  in  period  t  following  a  direct  or  indirect 
interdiction. 

G*  =  Set  of  generators  g  that  could  be  out  of  service  in  period  t  following  a  direct  or  indirect 
interdiction. 

/?,  e  helps  us  define  these  sets  precisely.  In  particular: 

Xf  =1,  °r 

/?(Bus  =  1  for  some  i  \  l  e  LBtus ,  or 
=  1  for  some  s\l  e  Ls"h ,  or 
=  1  for  some  ll\lle  Lp,ar 


l  e  Zf  if  either:  j 
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g  e  G  *  if  either: 


/ODUS  1  _ 

A,i(g)  _  1  ’  or 


A; 


Sub 

■K*(g)) 


=1 


Additional  definitions  are: 
f  1,  if  /  g  Z* 


K  =  - 


0,  otherwise 


x°,=  '• ifgeG 

0,  otherwise 


A'  = 


A  = 


j  1,  if  i  g  I 
[0,  otherwise 
[l,  if  5  G  S* 

1 0,  otherwise 


al  =  1 1,  if  /  G  L, 

0,  otherwise 


4  = 


|1,  if geG(" 

1 0,  otherwise 


(Hereafter,  equations  in  |boxes|  represent  final  constraints  in  our  models.) 


The  objective  function  of  the  interdiction  problem  with  restoration  (I-DC-OPF-R)  becomes: 


max  min 

SeA  (Pfen  ,rfine , 
s,,0,)e  r 


(I-R.0) 


where,  as  in  the  case  without  time  periods,  we  attempt  to  minimize  power  generation  cost  plus 
load  shedding  cost,  but  this  time  these  terms  are  specified  by  time  period  and  weighed  by  its 
duration,  in  order  to  account  for  energy  cost. 

5  e  A  still  represents  the  resource-constrained  interdictions  that  a  terrorist  group  might  be 
able  to  carry  out,  and  is  the  same  as  in  the  case  without  time  periods.  Or,  explicitly: 


^  MGe"  SGen  +  ^  Mbme  5fine  +  'YjMf1'"  Sfm  +  ^  Mf‘b  5f,b  <M 


gsG 


leL 


iel 


seS 


(I-R.1) 


All  8  -variables  are  binary 


(I-R.2) 


(Pi  ,PtLme ,&t,St)  e  r  represents  the  time-dependent  decision  variables  of  the  inner 
DC-OPF-R  (DC-OPF  model  with  restoration).  These  constraints  (and  the  associated  duals, 
denoted  as  n  with  appropriate  sub-  and  super-indices)  are  explicitly  stated  as: 

•  Admittance  equation  for  line  /,  subject  to  possibly  being  out  of  service  during  period 
t: 


•  Balance  equation  for  the  bus  i  in  period  t: 

(IDC-R.2) 


•  Line  l  capacity,  subject  to  possibly  being  out  of  service  during  period  t: 


(IDCR.3) 
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It  is  worth  noting  that,  for  the  each  line  /,  we  need  five  constraints  to  specify  its  maximum 
capacity  in  period  t,  and  another  five  constraints  for  the  minimum  capacity.  For  example, 
consider  the  case  where  a  line  l  can  be  interdicted,  but  it  is  not  connected  to  an  interdictable  bus 
or  substation.  Then,  /  eL**for  some  of  the  first  periods  t  (e.g.,  t=l,2,3),  but  since  the  line  is 

guaranteed  to  be  back  in  service  after  Dur(l)  hours,  /  ^  Lt  for  the  rest  of  the  periods 

(e.g.,  t=4,5,6).  Assuming  also  that  the  line  has  no  other  lines  in  parallel,  the  constraints  to  be  used 
will  be: 


pLine  ✓  pLine 
*t,l  ~  *1 

in 

II 

jyLine  ✓  Ty Line  si  c* Line\ 

PtJ  <P,  (1  -S,  ) 

f  =  1,2,3 

On  the  other  hand,  if  the  line  is  connected  to  an  interdictable  bus,  and  the  bus  outage  covers, 
for  example,  periods  t=  1,...,5,  the  constraints  would  be: 


pLine  ^  pLine 
*t,I  ~  *1 

t  =  6 

jyLine  ^  J-yLine  /i  c 'Line\ 

P,j  ^ pi  ( l~di  ) 

t  =  1,2,3 

ryLine  ^  fyLine  /i  c*Bus\ 

P,  <  Pt  (l-S,  ) 

t  =  1,2, 3, 4, 5 

•  Generator  g  maximum  output,  subject  to  possibly  being  out  of  service  during  period 

t: 


pGen  >•  pGen 
rt,g  ~  rg 

vt,geG: 

<>2) 

Pt,s  ~Pg  C1"^  ) 

\/t,g\geG\^=l 

«) 

pGen  ^  pGen  /i  rBus  \ 
rt,g  ~rg  "  °i(g)' 

Vt,g\i(g)ef,fit%=1 

«) 

ryGen  /  jyGen  /-i  ?Sub  \ 

p,,g  <pg  a-<W 

\/t,g\s(i(g))eS\/3™g)=l 

«) 

(IDC-R.4) 


•  Demand  shedding  at  bus  i  for  customer  c: 


s,u  ^  di,c 


(IDC-R.5) 
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Variable  sign: 


(IDC-R.6) 

In  summary,  our  interdiction  model  with  restoration,  (I-R),  becomes: 

(I-R):  max  min  (I-R.O) 

8  pf‘n  ,p,Lme  ,s,,e, 

subject  to: 

(I-R.  1),  (I-R.2)  and 
(IDC-R.1)  to  (IDC-R.6) 

3.3  Heuristic  Algorithm  for  the  Interdiction  Problem  with  Restoration 

The  algorithm  that  we  use  to  solve  (I-R),  i.e.,  a  problem  without  restoration,  is  schematically 
depicted  in  Figure  2. 


Figure  2:  Interdiction  algorithm  framework  (without  restoration). 


This  algorithm  first  solves  DC-OPF  assuming  no  attacks.  The  power-flow  pattern  is  used  to 
assign  relative  values  to  all  the  components  of  the  power  grid.  These  values  are  used  to  maximize 
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the  estimated  value  of  the  assets  to  be  interdicted,  while  ensuring  that  the  resources  required  for 
the  interdiction  plan  are  not  exceeded.  With  this  interdiction  plan,  we  modify  the  right-hand  side 
of  DC-OPF  model  (disregarding  restoration)  and  obtain  its  solution.  In  this  case,  we  expect  part 
of  the  load  to  be  shed.  The  process  continues  by  finding  alternative  sets  of  valuable  assets  to 
interdict  that  have  not  been  identified  at  earlier  iterations,  and  by  evaluating  load  shedding  for 
each  of  these  interdiction  plans.  More  details  on  the  algorithm  can  be  found  in  Salmeron  et  al. 
[2003-11]. 

We  can  adapt  this  algorithm  to  the  model  with  restoration  by  solving  the  new  DC-OPF 
problem  in  the  upper  box  in  Figure  2,  assuming  that  all  5  -variables  have  been  fixed  (say  5  =  5, 
satisfying  (I-R.l)  and  (I-R.2)).  That  problem,  denoted  DC-OPF-R(5  ),  becomes: 


DC-OPF-R(  5 )  : 


min  (I-R.O) 

pGen  pLine  g  q 

subject  to:  (IDC-R.  1)  to  (IDC-R.6) 


DC-OPF-R(  5  )  (called  “sub-problem”  in  the  above  algorithm,  for  a  specific  interdiction  plan 
5  ),  provides  the  joint  power  flow  patterns  for  a  number  of  system  “stages”:  one  for  each 
restoration  period.  Notice  that  DC-OPF -R(  5  )  decomposes  into  |  T  [  sub-sub-problems,  each  of 
which  consists  of  an  instance  of  DC-OPF  with  some  subset  of  system  components  being  “out  of 
service.”  Outaged  components  are  determined  by  5  (interdictions)  and  by  /?  ,  which  informs 
DC-OPF  about  the  status  of  interdicted  components  in  period  t. 

In  addition  to  this  modification,  our  heuristic  algorithm  also  redefines  the  concept  of  “value,” 
which  is  used  to  determine  which  grid  components  appear  more  attractive  for  interdiction  in  each 
iteration.  We  maintain  the  same  concept  of  value  (denoted  as  a  vector  V)  as  in  our  previous  work 
(again,  see  details  in  Salmeron,  Wood,  and  Baldick  [2003-1]),  but  noticing  that  these  values  must 
be  multiplied  by  Dur(e)  (for  a  generic  component,  e)  in  order  to  account  for  energy-based 
values.  Therefore,  assuming  the  definitions  of  value  from  previous  work,  the  new  definition  of 
value  for  every  generic  component  e  is: 

v  Restoration^)  =  x  y  No-Restoration(e) 


12 


With  these  values,  the  “master  problem”  can  find  potentially  good  interdiction  plans  5  that 
have  not  been  explored  yet.  The  master  problem  (MP-R)  at  a  specific  iteration  r  is: 


MP-R(Vr,Ar):  max  \T  -S 

8 

subject  to: 

Eqs.  (1-R.l)  -  (I-R.2)  replacing  5  with  5r ,  and: 


(MP-R.l) 


(MP-R.  2) 


where  Ar  is  a  set  that  contains  the  information  on  all  previously-generated  interdiction  plans.  The 
first  block  of  constraints  (MP-R.  1 )  are  valid  inequalities  to  ensure  that  a  system  component  is  not 
interdicted  if  it  has  been  indirectly  interdicted  by  an  element  to  which  it  is  connected.  (Remark: 
The  valid  inequalities  (MP-R.2)  also  need  to  be  adjusted  when  considering  system  restoration 
because  they  were  based  on  arguments  that  ignored  repairs  over  time.)  The  second  block 
(MP-R.l)  are  super-valid  inequalities  that  account  for  previously  generated  solutions  in  the 
algorithm,  in  order  to  always  examine  alternative  solutions. 
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Figure  3  sketches  a  framework  for  the  new  algorithm. 


Solve  the  DC-OPF-R  for  the  given 
Interdiction  Plan: 

Solve  1 7]  DC-OPF  problems 


Based  on  present  and  previous  flow 
patterns,  assign  an  (energy-based) 
“Value”  to  each  interdictable  asset 


MP-R:  Maximize  the  Value  of  the 
Assets  to  be  Interdicted  (excluding 
previously  explored  solutions) 


Figure  3:  Interdiction  algorithm  framework  (with  restoration). 


A  more  detailed  version  of  this  algorithm  (I-ALG-R)  follows: 


I-ALG-R 

Input:  Grid  data;  Interdiction  data;  rmax  (iteration  limit). 

Output:  8*  is  a  feasible  interdiction  plan  causing  a  disruption  with  cost  ■{ .  If  the  algorithm  exits 
because  MP(Vr,Ar)  is  infeasible,  then  all  feasible  plans  have  been  enumerated,  and  8*  is  therefore 
optimal. 

Initialization: 

8‘  <-  ( 8 c“'' , 8 UneA , 8 Hm'' , 8,s"6’' )  <-  (0,0,0,0)  (initial  attack  plan). 

8*  <-  S1  (best  plan  so  far)  and  A1  {81}. 
y*  <r-  0  (cost  of  the  best  plan  so  far). 
t  <—  1. 

Subproblem: 

Solve  DC-OPF-R(8r)  for  objective  value  y(8r)  and  solution 

pr  =(pi“",pfe"-r,sr,0r)- 

If  y(8r)  >  y*,  then  y*  y(5r) ,  and  8*  <-8r. 

If  t  =  rmax  ,  then  Print  (8*,  y' )  and  halt. 
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Master  Problem: 


Compute  estimated  values: 

yr=^yGe».r  yl«,r  yS«!,i  ySub.i'j  _j_^^yG™,r'  -yUm.r'  yBus.t'  ySui.r'^. 

r  r'=l 

Solve  MP-R(Vr,Ar)  for  5,+1. 

If  MP-R(Vr,Ar)  is  infeasible,  then  Print  (5*,  /)  and  halt. 

-  Ar+1  <—  Ar  u  {5r+1}. 

T<—  T  +  l. 

Return  to  Subproblem. 

4,  MIXED-INTEGER  REFORMULATION  OF  THE  INTERDICTION  MODEL 
4.1  Preliminary  Ideas 

We  would  prefer  to  convert  the  model  (I-R)  into  a  standard  (minimizing  or  maximizing) 
mixed-integer  program  (MIP)  because  a  wealth  of  techniques  exist  to  solve  such  models 
efficiently.  (I-R)  possesses  several  features  that  make  this  conversion  difficult,  however: 

•  (I-R)  is  as  a  max-min  problem,  not  a  simple  minimization  or  maximization.  This 
difficulty  can  be  overcome  by  “dualizing”  the  inner  minimization  (DC-OPF-R).  This 
converts  (I-R)  into  max-max  problem,  i.e.,  a  “simple”  maximization.  However,  as 
we  will  see  later,  this  conversion  leads  to  other  difficulties  that  must  be  overcome. 

•  (I-R)  is  highly  non-linear  due  to  the  presence  of  multiple  products  of  variables 
associated  with  the  admittance  equation  (IDC-R.1). 

The  following  two  ideas  enable  us  to  convert  (I-R)  into  a  MIP: 

(a)  Dropping  equality  non-linear  constraints: 

Consider  an  admittance  equation  for  a  generic  line,  with  potential  interdiction,  represented  as 
a  non-linear  equality  of  the  form: 


P  =  B{ea-0b)(\-8l){\-52), 
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along  with  capacity  constraints: 


P<P(1-^)  and  P<P(l-S2) 


P^-Pil-S,)  and  P  >  —P(l  -  S2). 


Here,  P ,  0a  and  0h  are  continuous  decision  variables  representing  power  flow  on  the  line 
and  phase  angles  at  buses  a,  b,  respectively;  8X  and  S2  are  binary  decision  variables  representing 

two  possible  ways  to  interdict  the  line,  say,  attacking  the  line  directly  and  attacking  one  of  the 
buses  the  line  is  connected  to. 


When  both  8X  and  S2  are  0,  the  admittance  equation  and  capacity  constraints  become: 
P  =  B(0a-0b )  ,  P  <  P  ,  P>  —P  ,  which  is  the  usual  power  flow  admittance  equation  and 
capacity  constraint.  On  the  other  hand,  if  either  8X  or  S2  equals  1,  indicating  an  interdiction  has 
occurred,  the  above  equations  become:  P  —  0  ,  P  <  0 ,  P>  0 ,  which  is  the  desired  effect — there 
is  no  power  flow  on  the  line,  while  Oa  and  9h  may  vary  independently  now. 


Remark:  It  does  not  suffice  to  set  P  <  0  and  P  >  0  using  the  capacity  constraints  only.  The 
reason  is  that  although  this  would  imply  P  —  0  ,  the  admittance  constraint  would  become 
0  =  B(6a  —0^  ,  forcing  Oa  —  0h  ,  which  is  not  necessarily  optimal. 


To  avoid  the  nonlinearities  in  the  admittance  equation,  we  can  establish  two  constraints  that 
enforce  P  —  B(0a  —Oh )  when  all  8  -variables  are  0,  and  “drop”  this  constraint  when  any  of  the 

8  -variables  is  1 .  Let  0ah  be  an  upper  bound  on  the  absolute  value  of  the  maximum  phase  angle 
difference,  define:  M  -  P  +  BOah ,  then 


P  =  B(Oa  —  0b)(l  —  8x)(l  —  82) 


j P-B(0a-0b)<M(8l+82 ) 

1  P-B(0a-0b)>-M(81+82Y 


(LI) 


Notice  that  when  both  r)’,  and  S2  are  0,  the  two  linear  inequalities  (L.I)  yield  precisely 
P  —  B(Oa  —  Oh )  =  0 .  If  either  Sxor  S2  equals  1,  the  upper  and  lower  bound  limits  on  the 
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constraints  are  sufficiently  large  that  they  can  never  bind,  i.e.,  the  original  constraints  vanish  as 
they  should. 

(b)  Linearizing  cross-products: 

In  the  development  that  follows,  we  encounter  a  number  of  cross-products  of  the  form  8n , 
where  5  is  a  0-1  variable,  representing  interdiction,  and  K  is  a  continuous,  non-negative  or 
non-positive  variable  representing  the  dual  variable  for  a  line  capacity  constraint  like  those  in 
(IDC-R.3). 

For  simplicity,  let  us  assume  that  n  >  0  and  that  an  upper  bound  n  >  n  is  known.  The  n 
bound  can  be  established  by  analyzing  the  maximum  benefit  per  unit  that  we  could  obtain  by 
increasing  the  line  capacity.  Assuming  that  the  largest  penalty  for  failing  to  meet  the  demand 
(max  fic )  is  greater  than  the  maximum  generating  cost  (max/?  ),  a  bound  that  would  work  in 

most  cases  is  n  =  max  fic .  A  more  conservative,  but  generally  valid,  bound  is 

i,c  ’ 

k  =  2-  max  f\  -  min  f\  . 

l,C  l,c 

If  we  define  a  new  continuous  variable  v  =  8n ,  we  can  represent  the  cross  product  in  linear 
form  as: 


8n 


v  <n8 
V<71 

<  v  >  n  -n(\  -8) 
0  <  n  <  n 
v  >  0 


(L.H) 
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The  following  diagram  shows  the  validity  of  this  transformation: 


v  <  W5 
v<n 

v  >  n  -n{\ 
0  <n  <n 


8  =  0^ 


8) 


v  >  0 


8  =  1=> 


v  <  0 

V<71 


v>n-n 


0  <n<n 
v  >  0 


v<n 

V<7t 

v>n 
0  <  n  <  n 
v  >  0 


Jv  =  0 


V  =  TV 

n  e  [0,  tt] 


4.2  Linearizing  Admittance  Equations 

Using  the  linearizing  inequalities  (L.I),  we  can  convert  the  admittance  equations 


p,Lr=m,0 1 1 

ie/'/ei?" 

n  a-. 

o")  n 

(i-A^D  v/,vt 

«) 

ssS'/eif6 

(IDC-R.1) 


into  the  following  linear  expressions: 


p,T-B,{euom-dum)<MxKhKP"rsl'im+  Z  P»s?m+  Z  /W*  +  X  /W"e)  v/ ,w  (<) 


z  /W“+  z  z  #w)  vz,v/«,+)| 

ie/|/eLf"  seS*|/eZjlt 

(IDC-RM) 


The  revised  interdiction  model  with  restoration,  (l-R'),  becomes: 

(i-R'):  max  min  (I-R.O) 

8  pfen,p,Um  ,s„e, 

subject  to: 

(I-R.  1),  (I-R.2) 

(IDC-R'.l) 

(IDC-R.2)  to  (IDC-R.6) 
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Accordingly,  the  inner  power-flow  problem  can  be  called  (DC-OPR-R'): 


(DC-OPF-R'):  min  (I-R.0) 

pCm  pLi"e  s  g^ 

subject  to: 

(IDC-R'.l) 

(IDC-R.2)  to  (IDC-R.6) 


where  we  assume  a  given  interdiction  plan  8  =  8. 

4.3  Duality:  Converting  the  Model  into  a  Simple  Mixed-Integer  Program 

If  we  take  the  dual  of  the  inner  model  in  (I-R'),  i.e.,  the  dual  of  (DC-OPF-R'),  we  obtain: 
Model  (D-I-R'): 


E<E 


max  max  >  jvl  ,  >  < 
8 


w  <<-<;)+  z  w  «-<) 


isl  \IgLj1 


\  '  n  Sub  c  Sub  (-.A'  A+  \  .  \  '  nL  eLine  (-.A'  A+  \ 

+  Zj  A,,  oa  {ntl  -  jctJ  )  +  A ,us „  (x,j  -  x,j  ) 

«eP|/Eif/"e 


sgS  \leLf 


+E(E‘0-*“+EE',> S  +  E  I  ?('-<■)< 


g«G 


+  I  I  I  E 


g|i(ir)e/’  g|«(i(g))eS*  ilA5"6 


(75 

g 


,*(*'(*)) 


+EEC(^5-<;)+E  E  ^(i-<s,“')(A, 

t  UC  /eL*  t\tfjne=l 

+  E  E  ^(i-O (^ -*,"*)+  E  E  ffa-O  (*£-<£) 

is/*|/EZfa  «|#s"=l  SES’l/Eif* 


+  E  E  t'o-mc-OtEi 

«Eii/E£f”  /i>»(£r=i 


Load 


i,c,t 


(D-I-R'.O) 


subject  to: 


Dual  constraints  for  power  generation: 


*5?,> +«, * mK,  vt,s  (O 


lGoWGo  ,  3G  «  ,  j/  oto  ^GS  ,  ^  GS 


(D-I-R'.  1) 
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Dual  constraints  for  power  flow  on  lines: 


u  +  <  +  (1  -  x*5  +*5)+ VPT<"'  +  +  £  (<?,  +  < ) 


ie/  l/elfMS,^7"=l 


Z  (<£+<£)+  Z  fe+<S/)-^“(V^(o=0’  (^S) 

rSuh  nSuh  i  ii  t*Im  rPar  rtl.ine.  i 


(D-I-R',2) 


•  Dual  constraints  for  power  shedding: 


7T™+^<D(t).fc,  V  t,i,C  (S,c ) 


(D-l-R'.3) 


•  Dual  constraints  for  phase  angles: 


- 1  b,  (<+<)+  £  £,(< +<,*)=<>,  v  1,1  («,,) 

l\o(l)=i  l\d(l)=i 


(D-I-R'.4) 


•  Dual  variable  sign: 


nBal  unrestricted 

AT  L„  LCap ~  LB  LS  LL  .  n 

/r  ,7t  0 ,7i  ,  n  ,n  ,n  <0 

A*  Lt  LCap *  LB *  LS+  LL*  n 

/z"  ,n  ,n  ,  k  ,n  ,n  >1) 

G„  G  GB  GS  ^  A 

n  ,n  ,n  ,  n  <  0 

Load  ^  a 

^  <  0 _ 

•  Interdiction  resource  (same  as  (1-R.  1 )  and  (1-R.2)): 


(D-l-R'.5) 


^  MGen  5Gen  +  V  Mfine  SBine  +Z  M?m  5?us  +  Y  Mf*  8s“b  -M 

geG* 


le  L 


/el 


seS 


(i-R.1) 


All  5  -variables  are  binary 


(1-R.2) 
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In  outline,  this  model  is: 


(D-I-R'):  max  min  (D-I-R'.O) 

5  n 

subject  to: 

(l-R-l)s  (I-R-2) 
(D-I-R'.l)  to  (D-I-R'.5) 


4.4  Linearizing  Cross-products  in  the  Objective  Function 

The  objective  function  (D-I-R'.O)  contains  cross-products  of  the  form  8n .  Using  the 
linearizing  technique  (L.II)  from  Section  4.1,  we  can  linearize  the  objective  function  as  follows: 
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In  addition,  we  require  a  set  of  constraints  of  the  form: 


v<n§ 

V<7C 

V>7t -7V{\-8) 

0  <n<n 
v  >  0 


(D-I-R'M) 


for  every  linearized  cross-product.  These  constraints  are  specified,  in  detail,  in  Appendix  B. 

The  final  model,  in  outline  form,  is: 

(D-I-R"):  max  (D-I-R".0) 

S,7T,V 

subject  to: 

(HU),  (I-R.2) 

(D-I-R'.  1)  to  (D-I-R'.5) 

(D-I-R”.  1) 

Model  (D-I-R")  is  the  culmination  of  all  the  linearizations  and  dualizations  described 
previously.  It  exhibits  multiple  advantages:  The  most  important  one  is  to  represent  the 
interdiction  problem  as  standard,  compact,  mixed-integer  program  (MIP).  That  means  that  any  of 
the  generic  optimization  techniques  available  for  solving,  bounding,  or  approximating  the 
solution  to  a  MIP  are  applicable  to  this  model. 

Hereafter,  we  refer  to  model  (D-I-R")  as  (I-MIP),  i.e.,  “Interdiction  problem  in  MIP  form.” 

5.  TEST  CASES 

We  present  a  summary  of  results  to  show: 

(a)  the  benefit  of  incorporating  system  restoration  into  our  analysis,  and 

(b)  the  potential  of  the  MIP  reformulation,  which  can  be  solved  exactly. 
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For  item  (a),  we  will  compare  the  enhanced  heuristic  with  system  restoration  (1-ALG-R)  with 
the  former  heuristic  (1-ALG).  For  item  (b),  we  will  compare  the  heuristic  solution  provided  by 
(1-ALG-R)  with  the  exact  solution  obtained  by  solving  the  M1P  reformulation  (1-M1P). 


Our  tests  are  carried  out  on  the  same  set  of  IEEE  reliability  test  networks  (“One”  and  “Two” 
Areas)  described  in  our  previous  report.  Assumptions  regarding  outage  duration  are  summarized 
in  the  following  table: 


Grid  Component 

Interdictable 

Resources  M 
(no.  of  terrorists) 

Outage  Duration  (h) 

Lines  (overhead) 

YES 

1 

72 

Lines  (underground) 

NO 

N/A* 

N/A* 

Transfonners 

YES 

2 

768 

Buses 

YES 

3 

360 

Generators 

NO 

N/A* 

N/A* 

Substations 

YES 

3 

768 

*Not  Applicable. 


Data  for  outage  durations  (i.e.,  repair  or  replacement  times)  are  based  loosely  on  IEEE 
[1999-1].  Outage  duration  for  transformers  is  768  hours.  For  overhead  lines,  instead  of  the  10  or 
11  hours  used  in  IEEE  [1999-1],  we  are  more  conservative  and  assume  72  hours.  This  is  justified 
because  (a)  we  expect  more  damage  to  result  from  the  intentional  destruction  of  a  line — this  would 
probably  involve  the  destruction  of  one  or  more  towers  [Miami  Herald,  2002] — than  the  average 
time  needed  to  repair  damage  from  common  natural  causes  such  as  lightning,  and  (b)  if  n  lines  and 
other  grid  elements  are  attacked,  total  repair  time  may  be  longer  if  fewer  than  n  repair  teams  are 
available.  We  also  assume  that  a  large  substation  requires  768  hours  for  repair,  but  buses,  for 
which  IEEE  [1999-1]  provides  no  data,  require  360  hours. 


5.1  Comparing  Solutions  with  and  without  System  Restoration 

Although  in  both  cases  below  1-ALG  finds  better  short-term  disruptions  (compare  power 
shed)  over  the  first  72  hours  following  the  attack,  it  is  clear  that  long-term  effects  are  better 
captured  by  1-ALG-R: 


Case/Algorithm 

Directly  Interdicted  Components. 
Resource:  M=6 

Time 

Period 

Power 
Shed  (MW) 

Energy 
Shed  (MWh) 

RTS-One-Area 

Lines:  All,  A20,  A21,  A25-1,  A27,  A33-1 

0-72  h 

1,373 

98,856 

I-ALG 

Total:  98,856  | 

RTS-One-Area 

Lines:  A23 

0-72  h 

902 

64,944 

I-ALG-R 

Transformers:  A7 

72-768  h 

708 

492,768 

Substations:  Sub-A2 

Total:  557,712  | 
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Case/Algorithm 

Directly  Interdicted  Components. 
Resource:  M=12 

Time 

Period 

Power 
Shed  (MW) 

Energy 
Shed  (MWh) 

RTS-Two-Areas 

Lines:  A20,  A21,  A27,  A33-1,  A35-1,  AB2, 

0-72  h 

2,516 

181,152 

I-ALG 

B20,  B21,  B25-1,  B27,  B33-1.  B34 

Total:  181,152  | 

RTS-Two-Areas 

Substations:  Sub-Al,  Sub-A2,  Sub-Bl,  Sub-B2 

0-768 

1,416 

1,087,488  | 

I-ALG-R 

Total:  1,087,488  | 

Although  our  goal  is  focused  on  long-term  disruption,  we  recognize  that  the  optimal  solution 
provided  by  the  1-ALG  model  is  still  an  insightful  measure  of  vulnerability  in  the  analysis  of 
short-term  effects. 

5.2  Comparing  Heuristic  and  Optimal  Solutions 

First  Goal:  Optimal  short-term  disruption.  In  this  case  we  are  comparing  1-ALG  with  a 
special  version  of  the  1-M1P  model,  in  which  there  is  only  one  period  “t  =  1 ,”  the  duration  of  this 
period  is  D]  —  1  hour,  and  the  duration  outage  for  all  interdictable  elements  e  e  g  is 
Dur(e)  - 1  hour. 

From  the  next  two  tables,  the  heuristic  solution  for  optimal  short-term  disruption  (provided 
by  1-ALG)  is  of  good  quality  when  compared  to  the  best  possible  provided  by  (1-M1P): 


Case/Algorithm 

Directly  Interdicted  Components. 
Resource:  M=6 

Power 
Shed  (MW) 

RTS-One-Area 

I-ALG 

Lines:  All,  A20,  A21,  A25-1,  A27,  A33-1 

1,373 

RTS-One-Area 

I-MIP 

Lines:  All,  A20,  A21,  A25-2,  A27,  A33-1 

1,373 

Case/Algorithm 

Directly  Interdicted  Components. 
Resource:  M=12 

Power 
Shed  (MW) 

RTS-Two-Areas 

I-ALG 

Lines:  A20,  A21,  A27,  A33-1,  A35-1,  AB2, 
B20,  B21,  B25-1,  B27,  B33-1,  B34 

2,516 

RTS-Two-Areas 

I-MIP 

Lines:  A21,  A25-1,  A27,  A33-1.B18,  B21, 
B25-1,B27,  B33-2 

2,781 

However,  this  quality  deteriorates  when  interdiction  resource  increases: 


Case/Algorithm 

Directly  Interdicted  Components. 
Resource:  M=24 

Power 
Shed  (MW) 

RTS-Two-Areas 

I-ALG 

Buses:  118,  123,216,217 

Substations:  Sub-Al,  Sub-A2,  Sub-Bl,  Sub-B2 

3,266 

RTS-Two-Areas 

I-MIP 

Lines:  A21,  A33-1,  A34,  B21,  B27,  B33-1 
Buses:  1 13,  1 15,  1 18,  213,  215,  218 

4,142 

24 


This  shows  the  MIP  optimal  solution  may  outperform  the  solution  provided  by  the 
heuristic  algorithm  by  25%  in  some  cases. 


Second  Goal:  Optimal  long-term  disruption.  In  this  case,  we  are  comparing  1-ALG-R  with 
the  1-M1P  configured  for  a  total  horizon  of  768  hours,  which  is  the  longer  time  to  repair  for  any 
component  in  our  test  cases. 


Again,  the  first  two  tables  below  show  that  the  heuristic  solution  for  optimal  long-term 
disruption  (provided  by  1-ALG-R)  is  acceptable  for  the  cases  tested. 


Case/Algorithm 

Directly  Interdicted  Components. 
Resource:  M=6 

Time 

Period 

Power 
Shed  (MW) 

Energy 
Shed  (MWh) 

RTS-One-Area 

I-ALG-R 

Lines:  A23 

0-72  h 

902 

64,944 

Transformers:  A7 

72-768  h 

708 

492,768 

Substations:  Sub-A2 

Total:  557,712  | 

RTS-One-Area 

I-MIP 

Lines:  A23 

0-72  h 

902 

64,944 

Transformers:  A7 

72-768  h 

708 

492,768 

Substations:  Sub-A2 

Total:  557,712  | 

Case/Algorithm 

Directly  Interdicted  Components. 
Resource:  M=12 

Time 

Period 

Power 
Shed  (MW) 

Energy 
Shed  (MWh) 

RTS-Two-Areas 

I-ALG-R 

Substations:  Sub-Al,  Sub-A2,  Sub-Bl,  Sub-B2 

0-768 

1,416 

T 

1,087,488 

otal:  1,087,488 

RTS-Two-Areas 

I-MIP 

Lines:  A23,  B23 

Transfonners:  A7,  B7 

Substations:  Sub-A2,  Sub-B2 

0-72  h 
72-768  h 

1,804 

1,416 

T 

129,888 

985,536 

otal:  1,115,424 

In  the  case  below,  the  solution  provided  by  the  heuristic  for  a  problem  with  a  larger 
interdiction  resource  value  still  exhibits  acceptable  quality. 


Case/Algorithm 

Directly  Interdicted  Components. 
Resource:  M=24 

Time 

Period 

Power 
Shed  (MW) 

Energy 
Shed  (MWh) 

RTS-Two-Areas 

I-ALG-R 

Buses:  1 16,  1 18,  215,  218 

Substations:  Sub-Al,  Sub-A2,  Sub-Bl,  Sub-B2 

0-360  h 

2,693 

969,480 

360-768  h 

1,416 

577,728 

Total:  1,547,208  | 

RTS-Two-Areas 

I-MIP 

Lines:  A30,  A33-2 

Transfonners:  A7,  B7 

Buses:  1 15,  1 18,  215,  218 

Substations:  Sub-A2,  Sub-B2 

0-72  h 

3,164 

227,808 

72-360  h 

2,716 

782,208 

360-720  h 

1,416 

577,728 

Total:  1,587,744  | 

6.  Vulnerability  of  Electric  Power  Grid  Analyzer  (VEGA) 

6.1  Overview 

VEGA  is  an  integrated  decision-support  system  comprising  a  GUI,  a  relational  database 
management  system  (RDBMS),  an  optimization  module,  and  an  administration  program  that 
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controls  all  of  those  components  (Figure  3).  VEGA  1.0  is  the  first  version  of  this  system  and  has 
been  built  on  the  Microsoft  (MS)  Windows  2000  operating  system  [Microsoft  2003].  This 
section  provides  an  overview  of  VEGA. 


MODEL  &  SOLVER 


Figure  3.  VEGA  decision  support  system. 

The  ultimate  goals  of  VEGA  are  to  enable  access  to  our  analytical  techniques  for  a  wide 
range  of  potential  users,  including  students  in  the  HSLD  curriculum,  and  to  bridge  the  gap 
between  the  underlying  mathematical  optimization  methods  and  the  decision-makers.  A 
preliminary  Web  page  has  been  set  up  for  this  project  [VEGA,  2003]. 

The  GUI  and  database  (DB)  are  key  to  organizing  planning  data,  reducing  clerical  error 
through  embedded  validations,  completing  missing  details,  filtering  information  according  to 
user’s  needs,  and  displaying  multiple  scenarios  with  their  results,  for  comparison  purposes.  The 
GUI  is  also  key  for  demonstrating  the  potential  that  optimization  techniques  have  for  planning 
interdiction  and  interdiction  defense. 


The  GUI  helps  prepare  power-network  data  for  analysis,  and  then  displays  analytical  results, 
by  enabling  easy  navigation  through  customized  tables  and  graphics  containing  problem  data  and 
results.  This  gives  a  user  easy  access  to  the  mathematical  analysis  of  a  problem  even  if  the  user 
in  not  an  expert  in  mathematical  modeling  and  optimization. 
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The  VEGA  optimization  module  performs  the  mathematical  analysis  of  the  problem 
independently  of  the  GUI.  The  purpose  of  the  GUI  is  to  prepare  the  case  data  to  be  analyzed  and 
to  retrieve  and  display  the  optimization  results  in  a  user-friendly  fashion.  VEGA  1.0’s  core  is  an 
optimization  model  that  assesses  the  maximum  possible  disruption  a  network  might  experience 
from  a  terrorist  attack.  Naturally,  this  core  can  work  as  independent  entity,  and  its  operation  is,  in 
fact,  transparent  to  the  user  of  VEGA. 

The  administration  program  and  the  GUI  are  implemented  in  the  MS  Visual  Basic  (VB)  6.0 
programming  language  [Microsoft,  1998],  supported  by  a  RDBMS  implemented  with 
MS  Access  2000  [Microsoft,  2003].  The  underlying  optimization  module  is  implemented  using 
GAMS  [GAMS,  2003,  Brooke  et  al.,  1996].  Data  transfer  and  synchronization  of  the  GUI  with 
GAMS  are  performed  by  means  of  plain  ASCII  files,  because  GAMS  is  not  available  as  a  callable 
or  dynamic  library;  therefore,  GAMS  executes  as  an  external  program. 

6.2  VEGA  GUI  Overview 

The  front-end  application  responsible  for  the  VEGA  GUI  uses  a  Windows-based 
methodology  that  facilitates  for  the  user: 

a.  Network  data  input; 

b.  Other  data  input,  including  possible  scenarios,  optimization  parameters,  etc.; 

c.  Analyzing  results  provided  by  the  optimization  model; 

d.  Graphical  display  of  the  network,  input  data,  and  output  results;  and 

e.  Administration  of  multiple  cases  with  several  scenarios  per  case. 
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Figure  4.  Examples  of  VEGA  data  tables. 

The  GUI  in  VEGA  1.0  uses  VB  tables  in  order  to  import  data  from  the  database,  and  edit  the 
records  associated  with  a  problem.  Figure  4  shows  an  example  of  data  tables  for  Buses  and 
Generators. 

Upon  completing  necessary  data  entry,  the  user  can  invoke  the  optimization  module  to 
produce  optimal,  or  near-optimal,  interdiction  plans.  These  plans  can  be  displayed  in  tabular 
form  (Figure  5)  or  in  graphical  form  (Figure  6). 
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Figure  5.  Interdiction  plan  shown  in  tabular  form. 


Figure  6.  Graphical  representation  of  overall  results  by  scenario  (left)  and  by  scenario  and  time  (right). 


One  important,  recent  accomplishment  has  been  the  enhancement  of  a  module  in  the  VEGA 
GUI  called  the  “One-Line  Diagram  (OD)  GUI.”  ODs  are  used  by  electrical  engineers  to 
represent  electric  power  grids  graphically.  The  VEGA  1.0  (see  VEGA  [2003])  OD  GUI  had 
many  limitations  that  have  been  overcome  through  the  thesis  research  of  an  NPS  student 
[Stathakos,  2003].  Figure  7  shows  one  of  the  new  OD  representations. 
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One-Line  Diagram 


^jojxl 


Scenano 
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Power  1  3.951  MW|  1749  MW 


Cum  Shed  Cum.  Cost 


$73.367/1i  [ 


J 


Energy  |  1 .422.360 MWh |  629.640MWh|  t26.412,120|  629  640MWh|  $656,052,120 


Figure  7.  One-Line  Diagram  for  an  electric  network  under  interdiction. 


The  above  snapshots  are  intended  to  give  an  overview  of  the  VEGA  GUI,  only,  and  a  full 
report  on  its  capabilities  will  be  provided  in  a  separate,  future  report. 


7.  OTHER  ACTIVITIES 
7.1  Thesis  Students 

To  date,  two  students  have  devoted  their  Master’s  thesis  research  to  our  project, 
Major  Dimitrios  Sthatakos  (Greek  Army)  and  LCDR  Roger  Alvarez  (USN). 

Major  Sthatakos,  who  graduated  in  December  2003,  enhanced  the  one-line  diagram  (OD) 
interface  in  our  VEGA  GUI.  The  OD  GUI  represents  the  details  of  power  flows  and  interdictions 
graphically  (Figure  7).  Major  Sthatakos  created  a  highly  flexible  OD  GUI  by  replacing  a 
prototypic  OD  GUI  (based  on  standard  Visual  Basic  objects)  with  an  advanced  OD  GUI  based  on 
state-of-the-art  ActiveX  controls.  For  more  information,  see  Sthatakos  [2003]. 
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LCDR  Alvarez  is  currently  working  on  the  M1P  representation  of  our  mathematical  models 
(see  Section  4)  and  on  their  solvability.  He  has  been  instrumental  in  completing  many  of  the 
refinements  to  the  M1P  described  in  this  report,  and  he  is  exploring  alternative  solution 
techniques  for  the  M1P,  with  special  focus  on  Benders  decomposition.  He  is  expected  to  graduate 
in  March  2004  [Alvarez,  2004]. 

We  continue  to  seek  the  involvement  of  NPS  students  in  our  project. 

7.2  Other  Reports  and  Activities 

In  addition  to  our  previous  report  [Salmeron,  Wood,  and  Baldick,  2003-1],  our  first  year’s 
work  has  yielded  a  refereed  publication:  “Analysis  of  Electric  Grid  Security  Under  Terrorist 
Threat,”  [Salmeron,  Wood,  and  Baldick,  2003-11],  which  will  appear  in  IEEE  Transactions  on 
Power  Systems.  The  feedback  from  the  four  reviewers  was  highly  positive. 

Also,  our  work  was  presented  in  the  CS3660  seminar  (Critical  Infrastructure  Protection)  as 
part  of  the  recently  created  HSLD  curriculum  at  NPS. 

7.3  Other  Sources  of  Funding 

The  Department  of  Justice  has  been  our  sole  source  of  funding  to  date.  We  are  seeking 
additional  research  support  from  the  Department  of  Energy  (proposal  submitted)  and  the 
National  Science  Foundation  (proposal  in  preparation). 

8.  FUTURE  WORK 

The  major  challenge  we  face  in  the  present  year  is  to  obtain  actual  U.S.  power-grid  data  for 
testing  and  validating  our  methodology.  In  doing  so,  we  need  to  continue  the  development  of 
techniques  to  solve  the  exact  models  (MIPs)  for  those  cases  and  other  realistically  sized 
problems.  (See  the  proposal,  Salmeron,  and  Wood  [2003],  for  more  detail.)  Currently,  we  are 
acquiring  data  sets  for  different  areas  in  the  U.S.  North  American  Electric  Reliability  Council 
system,  and  we  are  adapting  and  extending  those  data  for  our  purposes.  We  have  had  success  in 
formulating  our  models  as  MIPs,  but  additional  development  and  experimentation  is  needed  in 
order  to  be  able  to  solve  them  efficiently.  In  particular,  we  will  be  investigating  special  bounding 
techniques  and  specialized  cutting-plane  techniques  (Geoffrion,  [1972],  Israeli  and  Wood 
[2002]). 


31 


During  the  coming  year,  we  will  also: 

•  Continue  to  work  on  the  VEGA  GUI; 

•  Extend  our  models  and  algorithms  to  capture  the  dynamics  of  load  variation  over 
time.  This  requires  extension  of  the  VEGA  optimization  module,  as  well  as  the 
VEGA  database  and  GUI  (at  the  levels  of  data  and  result  management  and  of 
graphical  representations);  and 

•  Initiate  work  on  trilevel  models  to  identify  optimal  protection  plans  for  power  grids. 

9.  VALUE  OF  THE  RESEARCH  TO  HOMELAND  SECURITY 

The  call  for  proposals  that  this  research  addresses,  asks  how  our  research  adds  value  to  the 
Homeland  Security  effort.  We  respond  as  follows: 

Simulation  software  for  Homeland  Security  (HLS): 

Attacks  on  critical  infrastructure:  Power  Grids 

Deliverables  (this  document): 

Models  and  algorithms  (as  presented) 

Case  studies  (as  presented) 

Software  (optimization  algorithms  and  GUI  under  development) 

Publications  (as  presented) 

By  criterion  used  to  fund  the  project: 

This  research  addresses  an  important  problem  in  HLS 

This  research  adds  to  the  body  of  HLS  knowledge 

This  research  is  interdisciplinary 

This  research  is  novel  and  useful 

This  research  invites  non-NPS  collaborators 

-  Principal  Investigators  (Pis)  have  a  reputation  in  the  proposed  field  of  study 

-  Pis  will  try  to  get  students  involved  in  this  research  and  produce  theses 

-  Results  will  be  publishable 

-  Results  will  be  useful  in  teaching  HLS  courses 

-  Pis  believe  the  budget  is  in  line  with  the  results 
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APPENDIX  A:  SUMMARY  OF  PREVIOUS  NOTATION 


Indices  and  index  sets: 

ie  I ,  buses 
g  e  G ,  generating  units 
/  e  L ,  transmission  lines 
c  g  C ,  consumer  sectors 
jeS,  substations 
i  e  ls ,  buses  at  substation  s 

g  e  G, ,  generating  units  connected  to  bus  i 
1  e  L®“ ,  lines  connected  to  bus  i 

l  e  L“ ,  lines  connected  to  substation  s  (including  transformers,  which  are  represented  by  lines) 

/'  g  lflar ,  lines  /'  ^  /  running  in  parallel  to  line  / 

G’cG,  L*cL,  I  cI,  S’cS,  interdictable  generators,  lines,  buses,  and  substations,  respectively. 
These  are  “interdictable  components.” 

Parameters  (units): 

o(l),  d(J),  origin  and  destination  buses  of  line  /;  more  than  one  line  with  the  same  o(/),  d(l)  may 
exist 

Kg),  bus  for  generator  g,  i.e.,  g  e  Gi(g) 

s(i),  substation  for  bus  i,  for  i  e  I  \  3s  e  S  where  i  e  7S 

dic ,  load  of  consumer  sector  c  at  bus  i  (MW) 
pLme  }  transmission  capacity  for  line  l  (MW) 

p°m  ,  maximum  output  from  generator  g  (MW) 

i'i,  X; ,  resistance,  reactance  of  line  /  (Q).  (We  assume  xi » rt. );  series  susceptance  is 

B/  =  x,  !{rf  +  xf ) 

hg  ,  generation  cost  for  unit  g  ($/MWh) 

fc  ,  load-shedding  cost  for  customer  sector  c  at  bus  i  ($/MWh) 

M°e" ,  M,'"'" ,  M/'"' ,  Mssub ,  resource  required  to  interdict  generator  g,  line  /,  bus  i,  and  substation  s, 
respectively. 

M ,  total  interdiction  resource  available  to  terrorists. 


Decision  variables  (units): 

pGe„  }  generation  from  unit  g  (MW) 
pLme  )  power  flow  on  line  /  (MW) 

5  ,  load  shed  by  customer  sector  c  at  bus  i  (MW) 

0  ,  phase  angle  at  bus  i  (radians) 

gGe" }  gune  ?  ,  gSub ,  binary  vai'i allies  that  take  the  value  1  if  generator  g,  line  /,  bus  i  or  substation  s, 

respectively,  are  interdicted,  and  are  0  otherwise. 
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APPENDIX  B:  LINEARIZATION  OF  CROSS-PRODUCTS 

Explicit  list  of  constraints  for  equations  (D-I-R".  1)  in  model  (D-I-R"): 

VtJ\leL\teT,tf:r=\  (<0i) 

<0,  VM|/eI*Uer,^r  =  l  (r(fA) 

<;  Vf,/  |  /  e  ZT,f  e =  1  ;  ) 


5,4  /  - ,4  c*  Bus  \  /  ,  •  7  I  •  7"*  7  tBuS  .  rji  riBuS  i  /  5,4  \ 

,  Vt,i,l\iGl  ,IgL.  ,t&T,Pti  =1  Ow,0i) 

- <;  <  o,  V7 , i, / 1 1-  e r , /  e zf  ,t  g  t , pa = i  (^;)2 ) 

- <;  >  (1  -  5 A ),  \/t, i,l  \  i  g  I* ,1  g  L*r ,tGT, PA  =  1  C  > 


C  *  V7,.,/ 1 ,  E  5*,/  E  Ls:\t  G  T,PA= 1  (r"  „) 

<s  ^ o,  v/,,,/1  s g s* , i g Ls:\t g t,pa= i  oc>2) 

<  ^ -<(i-0>  VM,/| , E  s* ,i g Ls;\t  G t,pA= 1  (T^) 


v*,  *  *,/T>  VZ,/,//  \  ll  G  L  ,11  G  If  A ,  t  G  T,PAe= 1  Ow,) 

Vtt  -  nfj  <  0,  Vf ,  /,  // 1  //  E  if ,  //  E  4” ' ,  t  G  T,  PA  =  1  (rAlMh  ) 

fill- 71 U  ^  -KA~Sn',el  Vt,l,U  I  ll  G  If  pi  G  iff  A  ,  t  G  T,PAA  =  1  J 


^  e >  Vt,lGL,tGT,  PAe  =  1  (^A ) 

<;-<;<  0,  Vt,lElf,teT,pAe  =  1  (r(t/)2) 

<;  vi,/ eOe t, pAe=\  (rL) 
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Vf,  /,  / 1  i  e  r ,  /  e  L*,,s  ,t&T,  fi™  =  1  (^,0l) 
- <0,  \/t,l,i  |  /  e  /*,/  e  LBr  ,teT, =  1  ) 


-“  >-<,(! -<T),  V?,/,/ 1  i  e  / ,/  e  LBus,t  e  T,(3B“S=\  (yfi  ) 


'*  KSf* >  Vt,s,l\seS*,le  C  ,teT,  fi™  =  1  ) 

- <;  <o,  \/t,s,i  \  s  &  s* ,i  & Ls"b ,t  g t , p™ = i  (r“;)2 ) 

- > -< (l - ),  ,t£T,/3*;b  =\  (rZsh ) 

^XT  V/,/,// 1  //  e  r  ,11 G  Lf,f  e  T,P<7=1 
-<£,< 0,  v/, /, // 1 // g £ ,n g Lf , ? g r, #7 =1  (rZ,n)2 ) 

>  -^(l-Ce),  V/, /, // 1  //  e  r,ll  e  LfV  E  T,pjf=\  (y*) 


>-^sre,  Vf,/|/er,fer,/?,7‘  =  i  (r(t/}i) 

>o,  vu|/er,fer,y?7  =  i  «/)2) 

-<<<,(1-^),  v^,  /  I  /  e  L\t  e  T,PtLjne  =  l  (r£  ) 


>  -k^8b;\  Vt,i,l  1 1  6  /*,/  e  L*us ,t  e  T ,pf™  =  \  (rZ,0 

-  7i fd  >o,  v?,  i,  1 1 1  e  i ,  /  e  z,f" ,  /  e  t,  aT = i  o^;()2  > 

-  7cft  <  Wfl (1  -  SBus ),  Vt,i,l  1 1  e  /*,/  e  Lf“ ,fe7\  AT  =  1  (/To,  ) 


>-KK\  Vt,s,l\seS\leLs:b,teT,/3°:b  =1  (y^) 

-<>o,  v^,,/|,E5‘,/ELr^Er,AT=i  (/TT2) 

VM,/|JesVei^er,^=i  (TTJ 


v?,/,// 1 // eZ ,// eI?r,teT,fi;;e  =  1  0#A) 
-<>0,  w,/,//|//er,//€4’Ver,^=i  (r^/02) 

-<  <^(1-0  v/,/,// 1 // ez*,// =1  0&,) 


v/,/|iGr,tGT,^me=i  (^/}i) 
-<>0,  V^/|/er,tGT4ine  =  l  (7(M)2) 

<<,(1-^),  vM|/6r,t£T^me=i  (r 


VM',/]z£/,/£Zf“,tGT,/?t7s=l  (^,) 
-^:>o,  VM,/| /£/*,/£ zr,t£T,^=i  (^X,2) 

\/t,i,l\icl\lc Lb.us ,t  £ T,/?®us = 1, 


vwi^5Vezf,^r,^=i  (rS;}l) 
-<^■>0,  VM,/|^5Vezf,^r,^=i  (rS;s)2) 
-C<^(1-^),  VM,/|Je5Vezf,^r,^=i  (r; 


>-^r%  V^,/,//|//eZ,//g  L,  ,t  eT,  fit™  - 1  0^;//)i) 

-<^>o,  v^/,//|//£r,//£zf-,?£r,^r=i  (^//)2) 


-<f;<^(i-4),  vt,uii\iur,iunr,teT,pT=\  o£. 


v^g|g£^Er,^=i  o^) 
-<>0,  Vf,g|ge^er,/5^=1  (r^j 
-4<^-0  V^g|ge^er,/^=l  (y°) 


C*<C’  Vt,gmer,teT,/Q)=l  (/“,) 


v®-^>0,  Vi, g\i(g)eI~,t€T, ff“<  =  1  O'”  ) 


t,g  t,g  ’ 

GS  GB  ,  — G 


v»,g|<(g)€/  ,»€r,/c.=i 


C v/.gi^esr.f Gr,^te)) =1 

C  “ - °>  Vf>  S I  *0'te» ^S',t<=T, $gfe))  =  1  (y{ 

<  Zxfj,  V<,/|/eOer  «,*) 

C<^,  Vt,l\leL\teT, /?""=!  (tf) 


LB  ^  — L  w  ,  /.!.  7-  /  jDUS  ,  rri  nous  1  /  LB  \ 

7itl  .  <7Ttl,  Vt, l, 1 1  z  G /  , /  G L.  ,teT, (3ti  =  1  (/7//7 ) 

Z«S  /  —L  \  /  ,  7  |  rt*  7  T^ub  j  rri  rySub  -i  /  Z/5”  \ 

Vt,l,s\seS  ,leLs  ,teT,B  =1  (77  ) 


<*£,  V7,/,// 1  //er,//e^er,^=l  « 


<*,  >-<!,  V7,  / 1  /  g  Z* ,  7  g  T  {it,  ) 


Vt,l\l^£,t^T,ff"e=\  (rf.) 


LB  \  —  L  \ _ / ,  7  •  1  •  t*  1  tBus  .  rri  d  Bus  1  /  LB  \ 

7Tt  l  .  >  -ni  l ,  Vf,  /,  1 1 1  e  /  ,  /  G  L.  ,t  g  T,  (3t  i  =  1  (/7<  /  ; ) 

V7,/,5|5€5VeZr,^rX=l  (O 

va//|//er,//e^Er,^=l  {jlfui 


Klg--Kgi  Vt,g\g£G*,t£T,/3^  =1  (jfj 


n™>-n°  \/t,g\i(g)£l\t<ET,tffe=\  (O 


vt,g\  s(i(g))  &s\t<E  T,tr;ilan  =  1  (C) 
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